feat(infra): seed BIG catalogus + JWT client for OpenZaak (refs #2)

Provision a JWT client declaratively via OpenZaak setup_configuration
(infra/openzaak/setup_configuration/data.yaml: JWTSecret + Applicatie with
all authorizations), and seed the BIG catalogus + a lean BIG-REGISTRATIE
zaaktype (concept) + a bsn eigenschap via the ZTC API with an idempotent
stdlib seed (infra/openzaak/seed_catalogus.py, `make openzaak-seed`).

Disable outbound notifications until NRC lands (S-01-c) so ZTC writes don't
500. Bind-mount the config with :z (SELinux) for rootless Podman. Record
the design in ADR-0002; document seeding + the dev JWT client in the
OpenZaak runbook.

Verified clean-slate: down --volumes -> up -> `make openzaak-seed` creates
the catalogus/zaaktype/eigenschap and the JWT client lists BIG-REGISTRATIE;
re-runs are all-skip (idempotent).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/openzaak/docker-compose.yml

@@ -44,11 +44,18 @@ services:
       CELERY_BROKER_URL: redis://oz-redis:6379/1
       CELERY_RESULT_BACKEND: redis://oz-redis:6379/1
       DISABLE_2FA: "true"
+      # Notifications go to Open Notificaties (NRC), which arrives in S-01-c.
+      # Until then, disable outbound notifications so writes don't 500.
+      NOTIFICATIONS_DISABLED: "true"
       OPENZAAK_SUPERUSER_USERNAME: admin
       DJANGO_SUPERUSER_PASSWORD: admin
       OPENZAAK_SUPERUSER_EMAIL: admin@localhost
-      RUN_SETUP_CONFIG: "false"
+      RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
+    volumes:
+      # :z relabels for SELinux; the dir/file must be world-readable for the
+      # container user (rootless Podman uid mapping). See docs/runbooks/openzaak.md.
+      - ./setup_configuration:/app/setup_configuration:ro,z
     depends_on:
       oz-db:
         condition: service_healthy